mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-11-09 14:04:06 +09:00
rUvandReuven
455f0b17be
Hardened npm registries reject `@claude-flow/plugin-agent-federation@alpha` with `403 Forbidden` on `cookies@0.9.1` because of a deep transitive chain (agentic-flow → fastmcp → mcp-proxy → pipenet → koa → cookies). The plugin only uses agentic-flow for one function (`loadQuicTransport` as fallback), so it doesn't need to be a hard runtime dep. **package.json** - Moved `agentic-flow` from `dependencies` → `peerDependencies` with `peerDependenciesMeta.agentic-flow.optional = true` - Added `midstreamer` as a second optional peer (so an operator can pick either or both backends — per ADR-120's Step 2 loader) - Kept `agentic-flow` in `devDependencies` so vitest + tsc still resolve it in this workspace - Bumped version 1.0.0-alpha.15 → 1.0.0-alpha.16 **midstream-aware-loader.ts** - Replaced the static value import of `loadQuicTransport` with a lazy `loadAgenticFlowQuicTransport()` that uses direct dynamic `import()` (vitest-mockable) and falls back to `null` when the package isn't installed - Type imports remain static — they're erased at compile time, so TypeScript users still get full IntelliSense without forcing the install - `loadFederationTransport()` now throws a clear, actionable error when neither midstreamer nor agentic-flow is present, instead of silently crashing on a missing module **Impact** - Install size: 529 packages → 2 packages (verified via `npm pack` + fresh install in an empty workspace) - No more `cookies@0.9.1`, no more `koa-router@14.0.0` deprecation warning, no more 403 in hardened registries - 555/555 vitest tests pass (up from 549 — 6 loader tests now exercise the new lazy-import path) **audit-fix-invariants.mjs** - Added 4 new invariants checking the peer-dep wiring stays in place (package.json `peerDependencies` + `peerDependenciesMeta`, and the loader's type-only import + lazy loader symbol) - 38/38 invariants pass Closes #1949. Co-authored-by: Reuven <cohen@ruv-mac-mini.local>